Aaronson and Christiano [1]} proposed a scheme based on hidden subspaces of the vector space \(\mathbb {F}_2^n\) . In their scheme, a banknote consists of a quantum state \(\rho _s\)  that is a uniform superposition of elements in a random linear subspace \(A_s \subset \mathbb {F}_2^n\)  of dimension \(n / 2\) , and a serial number \(s\)  that provides membership oracles for \(A_s\)  and the orthogonal complement \(A_s^\perp \) . The verification of a banknote is done using a projection operator built from the membership oracles for \(A_s\)  and \(A_s^\perp \) .
